1

Is this function a secure way of transferring the locked value to the winner?

function resolve(bool _chooseHead, uint _randomNumber) public {
    require(msg.sender == partyA);
    require(keccak256(abi.encodePacked(_chooseHead, _randomNumber)) == commitmentA);
    require(address(this).balance >= 2 ether);
    
    if (_chooseHead == chooseHeadB)
        partyB.transfer(2 ether);
    else
        partyA.transfer(2 ether);
}

Or maybe doing something like this is a more secure way because it clearly uses the checks-effects-interaction pattern and the value of balance is always up-to-date?

function resolve(bool _chooseHead, uint _randomNumber) public {
    require(msg.sender == partyA);
    require(keccak256(abi.encodePacked(_chooseHead, _randomNumber)) == commitmentA);
    require(balance >= 2 ether);
    
    balance = 0 ether;
    if (_chooseHead == chooseHeadB)
        partyB.transfer(2 ether);
    else
        partyA.transfer(2 ether);
}

I'm just concerned whether the address(this).balance value is updated before the transfer completes or only after. Because if it does get updated only after the transfer completes, then the function can be prone to a re-entrancy attack.

Please advice!

Thanks a lot!

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.